SecurityWeek Briefing.

"Hacker conversations: John Kindervag, a making not a breaking hacker."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents. Accessed on 06 May 2025, 1409 UTC.

Content and Source: Email subscription via https://feedly.com.

https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Ffeeds.feedburner.com%2FSecurityweek

Please check email link or scroll down to read your selections. Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

Today

Hacker Conversations: John Kindervag, a Making not Breaking Hacker

by Kevin Townsend / 1h

John Kindervag is best known for developing the Zero Trust Model. He is a hacker, but not within our common definition of a hacker today. The post appeared first on SecurityWeek .

Second Wave of Attacks Hitting SAP NetWeaver After Zero-Day Compromise

6 TTPs

•

by Ionut Arghire / 1h

•

CVE-2025-31324

Threat actors are revisiting SAP NetWeaver instances to leverage webshells deployed via a recent zero-day vulnerability. The post appeared first on SecurityWeek .

US Charges Yemeni Man for Black Kingdom Ransomware Attacks

Yemeni national indicted for ransomware

•

by Eduard Kovacs / 1h

Rami Khaled Ahmed, a 36-year-old from Yemen, has been charged for launching ransomware attacks between 2021 and 2023. The post appeared first on SecurityWeek .

Samsung MagicINFO Vulnerability Exploited Days After PoC Publication

2 TTPs

•

by Ionut Arghire / 2h

•

CVE-2024-7399

Threat actors started exploiting a vulnerability in Samsung MagicINFO only days after a PoC exploit was published. The post appeared first on SecurityWeek .

Critical Vulnerability in AI Builder Langflow Under Attack

4 TTPs

•

by Ionut Arghire / 2h

CISA warns organizations that threat actors are exploiting a critical-severity vulnerability in low-code AI builder Langflow. The post appeared first on SecurityWeek .

Microsoft Warns of Attackers Exploiting Misconfigured Apache Pinot Installations

by Eduard Kovacs / 2h

Misconfigured Apache Pinot instances can and have enabled threat actors to gain access to sensitive information. The post appeared first on SecurityWeek .

Yesterday

Android Update Patches FreeType Vulnerability Exploited as Zero-Day

by Ionut Arghire / 5h

Android’s May 2025 security update includes patches for an exploited vulnerability in the FreeType open source rendering engine. The post appeared first on SecurityWeek .

White House Proposal Slashes Half-Billion From CISA Budget

Ex-CISA chief criticizes Trump loyalty cuts

•

by Ryan Naraine / 22h

The proposed $491 million cut is being positioned as a “refocusing”of CISA on its core mission “while eliminating weaponization and waste.” The post appeared first on SecurityWeek .

Doppel Banks $35M for AI-Based Digital Risk Protection

Doppel raises 35M Series B

•

by SecurityWeek News / 1d

The new investment values Doppel at $205 million and provides runway to meet enterprise demand for AI-powered threat detection tools. The post appeared first on SecurityWeek .

Kelly Benefits Data Breach Impact Grows to 400,000 Individuals

Exfiltration (Enterprise TA0010)

•

by Eduard Kovacs / 1d

Kelly Benefits has determined that the impact of the recently disclosed data breach is much bigger than initially believed. The post appeared first on SecurityWeek .

Critical Commvault Vulnerability in Attacker Crosshairs

2 TTPs

•

by Ionut Arghire / 1d

CISA has flagged a critical-severity Commvault vulnerability as exploited one week after technical details were released. The post appeared first on SecurityWeek .

Man Admits Hacking Disney and Leaking Data Disguised as Hacktivist

2 TTPs

•

by Eduard Kovacs / 1d

•

Man pleads guilty to Disney hack

A 25-year-old has admitted hacking Disney systems and leaking data under the guise of a hacktivist collective named NullBulge. The post appeared first on SecurityWeek .

Ransomware Group Claims Attacks on UK Retailers

11 TTPs

•

by Ionut Arghire / 1d

The DragonForce ransomware group has claimed responsibility for the recent cyberattacks on UK retailers Co-op, Harrods, and M&S. The post appeared first on SecurityWeek .

May 4, 2025

PoC Published for Exploited SonicWall Vulnerabilities

2 TTPs

•

by Ionut Arghire / 1d

PoC code targeting two exploited SonicWall flaws was published just CISA added them to the KEV catalog. The post appeared first on SecurityWeek .

Cybersecurity M&A Roundup: 31 Deals Announced in April 2025

by Eduard Kovacs / 1d

Thirty-one cybersecurity merger and acquisition (M&A) deals were announced in April 2025. The post appeared first on SecurityWeek .

TikTok Fined $600 Million for China Data Transfers That Broke EU Privacy Rules

TikTok fined for EU data violations

•

by Associated Press / 1d

EU privacy watchdog fined TikTok $600 million after a four-year investigation found that data transfers to China put users at risk of spying, in breach of strict EU data privacy rules. The post appeared first on SecurityWeek .

May 2, 2025

Raytheon, Nightwing to Pay $8.4 Million in Settlement Over Cybersecurity Failures

Raytheon Nightwing pay 84M$ settlement

•

by Ionut Arghire / 4d

The US government says defense contractor Raytheon and Nightwing agreed to pay $8.4 million to settle False Claims Act allegations. The post appeared first on SecurityWeek .

In Other News: NullPoint Source Code Leak, $17,500 for iPhone Flaw, BreachForums Down

7 TTPs

•

by SecurityWeek News / 4d

Noteworthy stories that might have slipped under the radar: NullPoint Stealer source code leaked, researcher earns $17,500 from Apple for vulnerability, BreachForums down after zero-day exploitation by police. The post appeared first on SecurityWeek .

UK Retailers Co-op, Harrods and M&S Struggle With Cyberattacks

4 TTPs

•

by Ionut Arghire / 4d

•

Harrods targeted by cyber attack

Major UK retailers Co-op, Harrods, and M&S are scrambling to restore services that were affected by cyberattacks. The post appeared first on SecurityWeek .

Nova Scotia Power Says Hackers Stole Customer Information

Emera Nova Scotia Power cybersecurity response

•

by Eduard Kovacs / 4d

Nova Scotia Power’s investigation has shown that the recent cyberattack resulted in the theft of some customer information. The post appeared first on SecurityWeek .

RSA Conference 2025 Announcement Summary (Day 3)

RSA Conference 2025 showcases cybersecurity

•

by SecurityWeek News / 4d

Hundreds of companies showcased their products and services this week at the 2025 edition of the RSA Conference in San Francisco. The post appeared first on SecurityWeek .

May 1, 2025

Microsoft Accounts Go Passwordless by Default

Microsoft makes accounts passwordless by default

•

by Ionut Arghire / 4d

Microsoft is prioritizing passwordless sign-in and sign-up methods, and is making new accounts passwordless by default. The post appeared first on SecurityWeek .

Ukrainian Nefilim Ransomware Affiliate Extradited to US

Ukrainian extradited for Nefilim ransomware

•

by Ionut Arghire / 4d

Ukrainian national Artem Stryzhak was extradited to the US and charged with using Nefilim ransomware in attacks on large businesses. The post appeared first on SecurityWeek .

Hawaii Cybersecurity Journal